Description
A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- RedHat / enterprise_linux7.0 – 7.0
- RedHat / enterprise_linux8.0 – 8.0
- RedHat / enterprise_linux9.0 – 9.0
- RedHat / enterprise_linux10.0 – 10.0
- X.Org / X server21.1.23
- X.Org / xwayland24.1.12
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:26562
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:26566
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:26590
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:26610
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:26709
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:28923
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:29844
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36083
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36085
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36086
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36087
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36632
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36633
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36634
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36768
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36791
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36792
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:36798
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:38502
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:38810
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:46377
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:46382
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:46385
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:46392
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:46456
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:46460
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:46473
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:49519
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2026-50260
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2485385
- MISChttps://gitlab.freedesktop.org/xorg/xserver/-/commit/f5abfb61994471023d8c6470428c8e30c411cc0b
- MAILING_LISThttps://lists.x.org/archives/xorg-announce/2026-June/003702.html
- VENDOR_ADVISORYhttps://redhat.atlassian.net/browse/PSIRTSUPT-16950
Updated 31m ago · 8 sources